Hi Julien, > Le 12 déc. 2018 à 14:28, Julien Laffaye <[email protected]> a écrit : > > > On Wed, Dec 12, 2018 at 12:24 PM Emmanuel Hocdet <[email protected] > <mailto:[email protected]>> wrote: > > Hi, > > I tried to improve the haproxy loading time with a lot of certificates, and > see a double file > open for each certificate (one for private-key and one for the cert/chain). > Multi-cert loading part have not this issue and is good candidate for sharing > code: > patches is this work with factoring/cleanup/fix. > > About speed: PEM file with private key in first position is far better. > > If you can consider this patches? > > ++ > Manu > > > Hello, > > I'm curious, do you have numbers concerning the open(2) optimization ?
Not much (a few seconds), because load cert and especially load key is the heaviest part, but avoid syscall for reload it's rather good when kernel has something else to do. > And also the PEM ordering, I did not know it mattered. > 5 to 10% speedup in my tests. I tested with pkcs12 format (with limited encryption) but it’s slower than pem. The best gain is with EC certificates (x2 vs RSA-2048) (load key is really the heaviest part) ++ Manu
